Unauthenticated Super Forms nonce mint via super_create_nonce AJAX action

Arnold Chan@slaz

•updated Sep 8, 2026•6•0•24

Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.